How to differentiate file and udp in Logstash output section?

Question

I'm new to Elasticsearch and Logstash.

In the Logstash conf file, if I have both "file" and "udp" as the source of the input, how do I differentiate them in the output?

For example:

input {
  file {
       path => ["/sample/data.log"]
 }
  udp {
       port => 9999
 }
}

How do I write the output part to differentiate them so I can save them in two different indices of Elasticsearch?

Answer 1

You can simply tag each document coming in from each input

input {
  file {
       path => ["/sample/data.log"]
       tags => ["file"]
  }
  udp {
       port => 9999
       tags => ["udp"]
  }
}
output {
  if "file" in [tags] {
    elasticsearch {
      index => "file-index"
      ...
    }
  }
  else if "udp" in [tags] {
    elasticsearch {
      index => "udp-index"
      ...
    }
  }
}